—
GO-2026-5985
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh
Quick fix
GO-2026-5985 — github.com/forgekeep/nebula-mesh: upgrade to the fixed version with the command below.
go get github.com/forgekeep/nebula-mesh@v0.7.2Details
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/forgekeep/nebula-mesh
Introduced in:
0.6.0 Fixed in: 0.7.2 Fix
go get github.com/forgekeep/nebula-mesh@v0.7.2